@@ -90,6 +90,7 @@ typedef enum X86OpSize {
X86_SIZE_w, /* 16-bit */
X86_SIZE_x, /* 128/256-bit, based on operand size */
X86_SIZE_y, /* 32/64-bit, based on operand size */
+ X86_SIZE_y_d64, /* 32/64-bit, based on 64-bit mode */
X86_SIZE_z, /* 16-bit for 16-bit operand size, else 32-bit */
X86_SIZE_z_f64, /* 32-bit for 32-bit operand size or 64-bit mode, else 16-bit */
@@ -247,9 +247,6 @@ STUB_HELPER(outb, TCGv_env env, TCGv_i32 port, TCGv_i32 val)
STUB_HELPER(outw, TCGv_env env, TCGv_i32 port, TCGv_i32 val)
STUB_HELPER(outl, TCGv_env env, TCGv_i32 port, TCGv_i32 val)
STUB_HELPER(rdmsr, TCGv_env env)
-STUB_HELPER(read_crN, TCGv ret, TCGv_env env, TCGv_i32 reg)
-STUB_HELPER(get_dr, TCGv ret, TCGv_env env, TCGv_i32 reg)
-STUB_HELPER(set_dr, TCGv_env env, TCGv_i32 reg, TCGv val)
STUB_HELPER(stgi, TCGv_env env)
STUB_HELPER(svm_check_intercept, TCGv_env env, TCGv_i32 type)
STUB_HELPER(vmload, TCGv_env env, TCGv_i32 aflag)
@@ -4192,82 +4189,6 @@ static void disas_insn_old(DisasContext *s, CPUState *cpu, int b)
gen_nop_modrm(env, s, modrm);
break;
- case 0x120: /* mov reg, crN */
- case 0x122: /* mov crN, reg */
- if (!check_cpl0(s)) {
- break;
- }
- modrm = x86_ldub_code(env, s);
- /*
- * Ignore the mod bits (assume (modrm&0xc0)==0xc0).
- * AMD documentation (24594.pdf) and testing of Intel 386 and 486
- * processors all show that the mod bits are assumed to be 1's,
- * regardless of actual values.
- */
- rm = (modrm & 7) | REX_B(s);
- reg = ((modrm >> 3) & 7) | REX_R(s);
- switch (reg) {
- case 0:
- if ((prefixes & PREFIX_LOCK) &&
- (s->cpuid_ext3_features & CPUID_EXT3_CR8LEG)) {
- reg = 8;
- }
- break;
- case 2:
- case 3:
- case 4:
- case 8:
- break;
- default:
- goto unknown_op;
- }
- ot = (CODE64(s) ? MO_64 : MO_32);
-
- translator_io_start(&s->base);
- if (b & 2) {
- gen_svm_check_intercept(s, SVM_EXIT_WRITE_CR0 + reg);
- gen_op_mov_v_reg(s, ot, s->T0, rm);
- gen_helper_write_crN(tcg_env, tcg_constant_i32(reg), s->T0);
- s->base.is_jmp = DISAS_EOB_NEXT;
- } else {
- gen_svm_check_intercept(s, SVM_EXIT_READ_CR0 + reg);
- gen_helper_read_crN(s->T0, tcg_env, tcg_constant_i32(reg));
- gen_op_mov_reg_v(s, ot, rm, s->T0);
- }
- break;
-
- case 0x121: /* mov reg, drN */
- case 0x123: /* mov drN, reg */
- if (check_cpl0(s)) {
- modrm = x86_ldub_code(env, s);
- /* Ignore the mod bits (assume (modrm&0xc0)==0xc0).
- * AMD documentation (24594.pdf) and testing of
- * intel 386 and 486 processors all show that the mod bits
- * are assumed to be 1's, regardless of actual values.
- */
- rm = (modrm & 7) | REX_B(s);
- reg = ((modrm >> 3) & 7) | REX_R(s);
- if (CODE64(s))
- ot = MO_64;
- else
- ot = MO_32;
- if (reg >= 8) {
- goto illegal_op;
- }
- if (b & 2) {
- gen_svm_check_intercept(s, SVM_EXIT_WRITE_DR0 + reg);
- gen_op_mov_v_reg(s, ot, s->T0, rm);
- tcg_gen_movi_i32(s->tmp2_i32, reg);
- gen_helper_set_dr(tcg_env, s->tmp2_i32, s->T0);
- s->base.is_jmp = DISAS_EOB_NEXT;
- } else {
- gen_svm_check_intercept(s, SVM_EXIT_READ_DR0 + reg);
- tcg_gen_movi_i32(s->tmp2_i32, reg);
- gen_helper_get_dr(s->T0, tcg_env, s->tmp2_i32);
- gen_op_mov_reg_v(s, ot, rm, s->T0);
- }
- }
- break;
case 0x106: /* clts */
if (check_cpl0(s)) {
gen_svm_check_intercept(s, SVM_EXIT_WRITE_CR0);
@@ -151,6 +151,8 @@
X86_OP_GROUP3(op, op0, s0, 2op, s0, op1, s1, ## __VA_ARGS__)
#define X86_OP_GROUPw(op, op0, s0, ...) \
X86_OP_GROUP3(op, op0, s0, None, None, None, None, ## __VA_ARGS__)
+#define X86_OP_GROUPwr(op, op0, s0, op1, s1, ...) \
+ X86_OP_GROUP3(op, op0, s0, op1, s1, None, None, ## __VA_ARGS__)
#define X86_OP_GROUP0(op, ...) \
X86_OP_GROUP3(op, None, None, None, None, None, None, ## __VA_ARGS__)
@@ -985,6 +987,24 @@ static void decode_0FE6(DisasContext *s, CPUX86State *env, X86OpEntry *entry, ui
*entry = *decode_by_prefix(s, opcodes_0FE6);
}
+/*
+ * These ignore the mod bits (assume (modrm&0xc0)==0xc0), so group the
+ * pre-decode tweak here for all MOVs from/to CR and DR.
+ *
+ * AMD documentation (24594.pdf) and testing of Intel 386 and 486
+ * processors all show that the mod bits are assumed to be 1's,
+ * regardless of actual values.
+ */
+static void decode_MOV_CR_DR(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
+{
+ /*
+ */
+ get_modrm(s, env);
+ s->modrm |= 0xC0;
+
+ entry->gen = gen_MOV;
+}
+
static const X86OpEntry opcodes_0F[256] = {
[0x0E] = X86_OP_ENTRY0(EMMS, cpuid(3DNOW)), /* femms */
/*
@@ -1004,6 +1024,15 @@ static const X86OpEntry opcodes_0F[256] = {
/* Incorrectly listed as Mq,Vq in the manual */
[0x17] = X86_OP_ENTRY3(VMOVHPx_st, M,q, None,None, V,dq, vex5 p_00_66),
+ /*
+ * Incorrectly listed as using "d" operand type in the manual. In reality
+ * there's no 16-bit version (like y) and it does not use REX.W (like d64).
+ */
+ [0x20] = X86_OP_GROUPwr(MOV_CR_DR, R,y_d64, C,y_d64, chk(cpl0) svm(READ_CR0)),
+ [0x21] = X86_OP_GROUPwr(MOV_CR_DR, R,y_d64, D,y_d64, chk(cpl0) svm(READ_DR0)),
+ [0x22] = X86_OP_GROUPwr(MOV_CR_DR, C,y_d64, R,y_d64, zextT0 chk(cpl0) svm(WRITE_CR0)),
+ [0x23] = X86_OP_GROUPwr(MOV_CR_DR, D,y_d64, R,y_d64, zextT0 chk(cpl0) svm(WRITE_DR0)),
+
[0x40] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
[0x41] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
[0x42] = X86_OP_ENTRY2(CMOVcc, G,v, E,v, cpuid(CMOV)),
@@ -1725,6 +1754,10 @@ static bool decode_op_size(DisasContext *s, X86OpEntry *e, X86OpSize size, MemOp
*ot = s->dflag == MO_16 ? MO_32 : s->dflag;
return true;
+ case X86_SIZE_y_d64: /* Full (not 16-bit) register access */
+ *ot = CODE64(s) ? MO_64 : MO_32;
+ return true;
+
case X86_SIZE_z: /* 16-bit for 16-bit operand size, else 32-bit */
*ot = s->dflag == MO_16 ? MO_16 : MO_32;
return true;
@@ -1802,11 +1835,34 @@ static bool decode_op(DisasContext *s, CPUX86State *env, X86DecodedInsn *decode,
case X86_TYPE_C: /* REG in the modrm byte selects a control register */
op->unit = X86_OP_CR;
- goto get_reg;
+ op->n = ((get_modrm(s, env) >> 3) & 7) | REX_R(s);
+ if (op->n == 0 && (s->prefix & PREFIX_LOCK) &&
+ (s->cpuid_ext3_features & CPUID_EXT3_CR8LEG)) {
+ op->n = 8;
+ s->prefix &= ~PREFIX_LOCK;
+ }
+ if (op->n != 0 && op->n != 2 && op->n != 3 && op->n != 4 && op->n != 8) {
+ return false;
+ }
+ if (decode->e.intercept) {
+ decode->e.intercept += op->n;
+ }
+ break;
case X86_TYPE_D: /* REG in the modrm byte selects a debug register */
op->unit = X86_OP_DR;
- goto get_reg;
+ op->n = ((get_modrm(s, env) >> 3) & 7) | REX_R(s);
+ if (op->n >= 8) {
+ /*
+ * illegal opcode. The DR4 and DR5 case is checked in the generated
+ * code instead, to save on hflags bits.
+ */
+ return false;
+ }
+ if (decode->e.intercept) {
+ decode->e.intercept += op->n;
+ }
+ break;
case X86_TYPE_G: /* REG in the modrm byte selects a GPR */
op->unit = X86_OP_INT;
@@ -2431,7 +2487,6 @@ static void disas_insn(DisasContext *s, CPUState *cpu)
case 0x00 ... 0x03: /* mostly privileged instructions */
case 0x05 ... 0x09:
case 0x1a ... 0x1b: /* MPX */
- case 0x20 ... 0x23: /* mov from/to CR and DR */
case 0x30 ... 0x35: /* more privileged instructions */
case 0xa2 ... 0xa5: /* CPUID, BT, SHLD */
case 0xaa ... 0xae: /* RSM, SHRD, grp15 */
@@ -242,12 +242,20 @@ static void gen_load(DisasContext *s, X86DecodedInsn *decode, int opn, TCGv v)
tcg_gen_ld32u_tl(v, tcg_env,
offsetof(CPUX86State,segs[op->n].selector));
break;
+#ifndef CONFIG_USER_ONLY
case X86_OP_CR:
- tcg_gen_ld_tl(v, tcg_env, offsetof(CPUX86State, cr[op->n]));
+ if (op->n == 8) {
+ translator_io_start(&s->base);
+ gen_helper_read_crN(v, tcg_env, tcg_constant_i32(op->n));
+ } else {
+ tcg_gen_ld_tl(v, tcg_env, offsetof(CPUX86State, cr[op->n]));
+ }
break;
case X86_OP_DR:
- tcg_gen_ld_tl(v, tcg_env, offsetof(CPUX86State, dr[op->n]));
+ /* CR4.DE tested in the helper. */
+ gen_helper_get_dr(v, tcg_env, tcg_constant_i32(op->n));
break;
+#endif
case X86_OP_INT:
if (op->has_ea) {
if (v == s->T0 && decode->e.special == X86_SPECIAL_SExtT0) {
@@ -343,8 +351,20 @@ static void gen_writeback(DisasContext *s, X86DecodedInsn *decode, int opn, TCGv
16, 16, 0);
}
break;
+#ifndef CONFIG_USER_ONLY
case X86_OP_CR:
+ if (op->n == 8) {
+ translator_io_start(&s->base);
+ }
+ gen_helper_write_crN(tcg_env, tcg_constant_i32(op->n), v);
+ s->base.is_jmp = DISAS_EOB_NEXT;
+ break;
case X86_OP_DR:
+ /* CR4.DE tested in the helper. */
+ gen_helper_set_dr(tcg_env, tcg_constant_i32(op->n), v);
+ s->base.is_jmp = DISAS_EOB_NEXT;
+ break;
+#endif
default:
g_assert_not_reached();
}
Complete implementation of C and D operand types, then the operations are just MOVs. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> --- target/i386/tcg/decode-new.h | 1 + target/i386/tcg/translate.c | 79 -------------------------------- target/i386/tcg/decode-new.c.inc | 61 ++++++++++++++++++++++-- target/i386/tcg/emit.c.inc | 24 +++++++++- 4 files changed, 81 insertions(+), 84 deletions(-)